Getting Data In

DateParserVerbose warnings

Anu
Explorer

HI,

I see lot of DateParserverbose warnings in splunkd.log on my indexers.

The errors goes as follows:

WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event

Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive

 

DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps.

 

 

Labels (1)
Tags (2)
0 Karma

thambisetty
Super Champion

take the event from the sourcetype for which you are seeing this error and try to upload using splunk web add data feature to understand if Splunk extracting time as expected. if not you need to define your right TIME_FORMAT in props.conf

————————————
If this helps, give a like below.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk detected that the timestamps in that data source are further apart than expected.  There are a couple possible explanations for that.

The data really does have timestamps that are far apart.  If this is expected then you can ignore the warning or change the MAX_DIFF_SECS_AGO setting in props.conf.

Splunk could be parsing the wrong timestamp or interpreting another string as a timestamp.  Review the TIME_PREFIX and TIME_FORMAT settings for the sourcetype in props.conf.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Anu
Explorer

But it was working well from long time.I see this errors from last 1 month.Is there any other reason why this can happen.

0 Karma

soutamo
SplunkTrust
SplunkTrust
Have you checked that nobody have changed that log and/or those nodes’ time is still correct?
0 Karma

Anu
Explorer

yes. i'm sure that nobody changed it.@soutamo

0 Karma